@yielded/auth 0.1.0-beta.1

package/dist/PasskeyContract.mjs

@@ -0,0 +1,174 @@
+import { LastSignInMethod } from "./identity/models.mjs";
+import { makeOperation, operationGroup } from "./operations/operation.mjs";
+import { PasskeyFailure } from "./passkey/errors.mjs";
+import { PasskeyAuthenticationStarted, PasskeyBegin, PasskeyCleanupResult, PasskeyComplete, PasskeyCredentialId, PasskeyCredentialSummary, PasskeyEnrolled, PasskeyLabel, PasskeyRegistrationComplete, PasskeyRegistrationResult, PasskeyRegistrationStarted, PasskeyRemoved } from "./passkey/models.mjs";
+import { Schema } from "effect";
+//#region src/PasskeyContract.ts
+/** Canonical passkey contracts without a verifier, storage, or authority Layers. */
+const makePasskeyContract = (moduleId, sessions) => {
+	const operations = {
+		Begin: makeOperation(`${moduleId}/passkey/sign-in/begin`, {
+			payload: PasskeyBegin,
+			success: PasskeyAuthenticationStarted,
+			error: PasskeyFailure,
+			exposure: "public",
+			access: "any",
+			replay: "single-use",
+			credentials: true
+		}),
+		Complete: makeOperation(`${moduleId}/passkey/sign-in/complete`, {
+			payload: PasskeyComplete,
+			success: sessions.CompletionResult,
+			error: PasskeyFailure,
+			exposure: "public",
+			access: "any",
+			replay: "single-use",
+			credentials: true
+		}),
+		Cleanup: makeOperation(`${moduleId}/passkey/cleanup`, {
+			payload: Schema.Struct({ limit: Schema.Int.check(Schema.isBetween({
+				minimum: 1,
+				maximum: 1e3
+			})) }),
+			success: PasskeyCleanupResult,
+			error: PasskeyFailure,
+			access: "system",
+			exposure: "internal",
+			replay: "non-idempotent"
+		})
+	};
+	return Object.freeze({
+		operations,
+		group: operationGroup(...Object.values(operations))
+	});
+};
+const makePasskeyRegistrationContract = (moduleId, codec) => {
+	const RegistrationCodec = codec;
+	const BeginInput = Schema.Struct({
+		...PasskeyBegin.fields,
+		registration: RegistrationCodec
+	});
+	const Begin = makeOperation(`${moduleId}/passkey/registration/begin`, {
+		payload: BeginInput,
+		success: PasskeyRegistrationStarted,
+		error: PasskeyFailure,
+		exposure: "public",
+		access: "any",
+		replay: "single-use",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/passkey/registration/complete`, {
+		payload: PasskeyRegistrationComplete,
+		success: PasskeyRegistrationResult,
+		error: PasskeyFailure,
+		exposure: "public",
+		access: "any",
+		replay: "single-use",
+		credentials: true
+	});
+	return Object.freeze({
+		BeginInput,
+		RegistrationCodec,
+		operations: {
+			Begin,
+			Complete
+		},
+		group: operationGroup(Begin, Complete)
+	});
+};
+const proof = Schema.optionalKey(Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384))));
+const listResult = Schema.Struct({
+	credentials: Schema.Array(PasskeyCredentialSummary).check(Schema.isMaxLength(64)),
+	cursor: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048)))
+});
+const makePasskeyManagementContract = (moduleId) => {
+	const BeginInput = Schema.Struct({
+		...PasskeyBegin.fields,
+		name: PasskeyLabel,
+		actionProof: proof
+	});
+	const CompleteInput = Schema.Struct({
+		...PasskeyRegistrationComplete.fields,
+		actionProof: proof
+	});
+	const ListInput = Schema.Struct({
+		cursor: listResult.fields.cursor,
+		limit: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 64
+		}))
+	});
+	const RenameInput = Schema.Struct({
+		commandId: PasskeyBegin.fields.commandId,
+		credentialId: PasskeyCredentialId,
+		name: PasskeyLabel
+	});
+	const RemoveInput = Schema.Struct({
+		commandId: PasskeyBegin.fields.commandId,
+		credentialId: PasskeyCredentialId,
+		actionProof: proof
+	});
+	const Failure = Schema.Union([PasskeyFailure, LastSignInMethod]);
+	const operations = {
+		Begin: makeOperation(`${moduleId}/passkey/enrollment/begin`, {
+			payload: BeginInput,
+			success: PasskeyRegistrationStarted,
+			error: PasskeyFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "single-use",
+			credentials: true
+		}),
+		Complete: makeOperation(`${moduleId}/passkey/enrollment/complete`, {
+			payload: CompleteInput,
+			success: PasskeyEnrolled,
+			error: PasskeyFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "single-use",
+			credentials: true
+		}),
+		List: makeOperation(`${moduleId}/passkey/list`, {
+			payload: ListInput,
+			success: listResult,
+			error: PasskeyFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "read-only"
+		}),
+		Rename: makeOperation(`${moduleId}/passkey/rename`, {
+			payload: RenameInput,
+			success: Schema.Struct({
+				credential: PasskeyCredentialSummary,
+				replayed: Schema.Boolean
+			}),
+			error: PasskeyFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "idempotent"
+		}),
+		Remove: makeOperation(`${moduleId}/passkey/remove`, {
+			payload: RemoveInput,
+			success: PasskeyRemoved,
+			error: Failure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "idempotent"
+		})
+	};
+	return Object.freeze({
+		BeginInput,
+		CompleteInput,
+		ListInput,
+		RenameInput,
+		RemoveInput,
+		Failure,
+		listResult,
+		operations,
+		group: operationGroup(...Object.values(operations))
+	});
+};
+//#endregion
+export { makePasskeyContract, makePasskeyManagementContract, makePasskeyRegistrationContract };
+
+//# sourceMappingURL=PasskeyContract.mjs.map

package/dist/PasskeyContract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyContract.mjs","names":[],"sources":["../src/PasskeyContract.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { LastSignInMethod } from \"./identity/models\";\nimport { makeOperation, operationGroup } from \"./operations/operation\";\nimport { PasskeyFailure } from \"./passkey/errors\";\nimport {\n  PasskeyBegin,\n  PasskeyComplete,\n  PasskeyAuthenticationStarted,\n  PasskeyCleanupResult,\n  PasskeyRegistrationComplete,\n  PasskeyRegistrationStarted,\n  PasskeyRegistrationResult,\n  PasskeyLabel,\n  PasskeyCredentialId,\n  PasskeyCredentialSummary,\n  PasskeyEnrolled,\n  PasskeyRemoved,\n} from \"./passkey/models\";\n\n/** Canonical passkey contracts without a verifier, storage, or authority Layers. */\nexport const makePasskeyContract = <\n  const Id extends string,\n  Session extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  Completion extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  sessions: { readonly Session: Session; readonly CompletionResult: Completion },\n) => {\n  const Begin = makeOperation(`${moduleId}/passkey/sign-in/begin`, {\n    payload: PasskeyBegin,\n    success: PasskeyAuthenticationStarted,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/passkey/sign-in/complete`, {\n    payload: PasskeyComplete,\n    success: sessions.CompletionResult,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Cleanup = makeOperation(`${moduleId}/passkey/cleanup`, {\n    payload: Schema.Struct({\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n    }),\n    success: PasskeyCleanupResult,\n    error: PasskeyFailure,\n    access: \"system\",\n    exposure: \"internal\",\n    replay: \"non-idempotent\",\n  });\n\n  const operations = { Begin, Complete, Cleanup };\n\n  return Object.freeze({ operations, group: operationGroup(...Object.values(operations)) });\n};\n\nexport const makePasskeyRegistrationContract = <\n  const Id extends string,\n  Registration extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  codec: Registration,\n) => {\n  const RegistrationCodec: Schema.Codec<\n    Registration[\"Type\"],\n    Registration[\"Encoded\"],\n    Registration[\"DecodingServices\"],\n    Registration[\"EncodingServices\"]\n  > = codec;\n\n  const BeginInput = Schema.Struct({ ...PasskeyBegin.fields, registration: RegistrationCodec });\n\n  const Begin = makeOperation(`${moduleId}/passkey/registration/begin`, {\n    payload: BeginInput,\n    success: PasskeyRegistrationStarted,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/passkey/registration/complete`, {\n    payload: PasskeyRegistrationComplete,\n    success: PasskeyRegistrationResult,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const operations = { Begin, Complete };\n\n  return Object.freeze({\n    BeginInput,\n    RegistrationCodec,\n    operations,\n    group: operationGroup(Begin, Complete),\n  });\n};\n\nconst proof = Schema.optionalKey(\n  Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384))),\n);\n\nconst listResult = Schema.Struct({\n  credentials: Schema.Array(PasskeyCredentialSummary).check(Schema.isMaxLength(64)),\n  cursor: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\nexport const makePasskeyManagementContract = <const Id extends string>(moduleId: Id) => {\n  const BeginInput = Schema.Struct({\n    ...PasskeyBegin.fields,\n    name: PasskeyLabel,\n    actionProof: proof,\n  });\n\n  const CompleteInput = Schema.Struct({\n    ...PasskeyRegistrationComplete.fields,\n    actionProof: proof,\n  });\n\n  const ListInput = Schema.Struct({\n    cursor: listResult.fields.cursor,\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n  });\n\n  const RenameInput = Schema.Struct({\n    commandId: PasskeyBegin.fields.commandId,\n    credentialId: PasskeyCredentialId,\n    name: PasskeyLabel,\n  });\n\n  const RemoveInput = Schema.Struct({\n    commandId: PasskeyBegin.fields.commandId,\n    credentialId: PasskeyCredentialId,\n    actionProof: proof,\n  });\n\n  const Failure = Schema.Union([PasskeyFailure, LastSignInMethod]);\n\n  const Begin = makeOperation(`${moduleId}/passkey/enrollment/begin`, {\n    payload: BeginInput,\n    success: PasskeyRegistrationStarted,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/passkey/enrollment/complete`, {\n    payload: CompleteInput,\n    success: PasskeyEnrolled,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const List = makeOperation(`${moduleId}/passkey/list`, {\n    payload: ListInput,\n    success: listResult,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"read-only\",\n  });\n\n  const Rename = makeOperation(`${moduleId}/passkey/rename`, {\n    payload: RenameInput,\n    success: Schema.Struct({ credential: PasskeyCredentialSummary, replayed: Schema.Boolean }),\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"idempotent\",\n  });\n\n  const Remove = makeOperation(`${moduleId}/passkey/remove`, {\n    payload: RemoveInput,\n    success: PasskeyRemoved,\n    error: Failure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"idempotent\",\n  });\n\n  const operations = { Begin, Complete, List, Rename, Remove };\n\n  return Object.freeze({\n    BeginInput,\n    CompleteInput,\n    ListInput,\n    RenameInput,\n    RemoveInput,\n    Failure,\n    listResult,\n    operations,\n    group: operationGroup(...Object.values(operations)),\n  });\n};\n"],"mappings":";;;;;;;AAqBA,MAAa,uBAKX,UACA,aACG;CAgCH,MAAM,aAAa;EAAE,OA/BP,cAAc,GAAG,SAAS,yBAAyB;GAC/D,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAuByB;EAAG,UArBX,cAAc,GAAG,SAAS,4BAA4B;GACrE,SAAS;GACT,SAAS,SAAS;GAClB,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAamC;EAAG,SAXtB,cAAc,GAAG,SAAS,mBAAmB;GAC3D,SAAS,OAAO,OAAO,EACrB,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAK,CAAC,CAAC,EACzE,CAAC;GACD,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;EACV,CAE4C;CAAE;CAE9C,OAAO,OAAO,OAAO;EAAE;EAAY,OAAO,eAAe,GAAG,OAAO,OAAO,UAAU,CAAC;CAAE,CAAC;AAC1F;AAEA,MAAa,mCAIX,UACA,UACG;CACH,MAAM,oBAKF;CAEJ,MAAM,aAAa,OAAO,OAAO;EAAE,GAAG,aAAa;EAAQ,cAAc;CAAkB,CAAC;CAE5F,MAAM,QAAQ,cAAc,GAAG,SAAS,8BAA8B;EACpE,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,iCAAiC;EAC1E,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAID,OAAO,OAAO,OAAO;EACnB;EACA;EACA,YAAA;GALmB;GAAO;EAKjB;EACT,OAAO,eAAe,OAAO,QAAQ;CACvC,CAAC;AACH;AAEA,MAAM,QAAQ,OAAO,YACnB,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CACjF;AAEA,MAAM,aAAa,OAAO,OAAO;CAC/B,aAAa,OAAO,MAAM,wBAAwB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAChF,QAAQ,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAa,iCAA0D,aAAiB;CACtF,MAAM,aAAa,OAAO,OAAO;EAC/B,GAAG,aAAa;EAChB,MAAM;EACN,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,OAAO,OAAO;EAClC,GAAG,4BAA4B;EAC/B,aAAa;CACf,CAAC;CAED,MAAM,YAAY,OAAO,OAAO;EAC9B,QAAQ,WAAW,OAAO;EAC1B,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAG,CAAC,CAAC;CACvE,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,WAAW,aAAa,OAAO;EAC/B,cAAc;EACd,MAAM;CACR,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,WAAW,aAAa,OAAO;EAC/B,cAAc;EACd,aAAa;CACf,CAAC;CAED,MAAM,UAAU,OAAO,MAAM,CAAC,gBAAgB,gBAAgB,CAAC;CAiD/D,MAAM,aAAa;EAAE,OA/CP,cAAc,GAAG,SAAS,4BAA4B;GAClE,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAuCyB;EAAG,UArCX,cAAc,GAAG,SAAS,+BAA+B;GACxE,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CA6BmC;EAAG,MA3BzB,cAAc,GAAG,SAAS,gBAAgB;GACrD,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;EACV,CAoByC;EAAG,QAlB7B,cAAc,GAAG,SAAS,kBAAkB;GACzD,SAAS;GACT,SAAS,OAAO,OAAO;IAAE,YAAY;IAA0B,UAAU,OAAO;GAAQ,CAAC;GACzF,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;EACV,CAWiD;EAAG,QATrC,cAAc,GAAG,SAAS,kBAAkB;GACzD,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;EACV,CAEyD;CAAE;CAE3D,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO,eAAe,GAAG,OAAO,OAAO,UAAU,CAAC;CACpD,CAAC;AACH"}

package/dist/PasskeyPassword.d.mts

@@ -0,0 +1,412 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "./operations/errors.mjs";
+import { AuthInvocation } from "./operations/context.mjs";
+import { AuthOperationResult } from "./operations/credentials.mjs";
+import { AuthOperation, OperationHandler } from "./operations/operation.mjs";
+import { HookDenied } from "./hooks/models.mjs";
+import "./Operations.mjs";
+import "./Auth.mjs";
+import { NewPasswordRejected, PasswordCheckUnavailable } from "./password/errors.mjs";
+import { PasswordActionRequired, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./password/methods/errors.mjs";
+import { PasswordPreparedContext } from "./password/methods/preparedModels.mjs";
+import { PasswordPreparedAuthorization, PasswordPreparedCompletionPlan } from "./password/methods/prepared.mjs";
+import { PasskeyAuthenticationStarted } from "./passkey/models.mjs";
+import { PasskeyActionRequired, PasskeyMethodUnsupported, PasskeyRejected, PasskeyUnavailable } from "./passkey/errors.mjs";
+import "./Passkey.mjs";
+import { makePasskeyActions } from "./passkey/actions.mjs";
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/PasskeyPassword.d.ts
+declare const PasswordFailure: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+type PasswordFailure = typeof PasswordFailure.Type;
+declare const Failure: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>;
+type Failure = typeof Failure.Type;
+interface Prepared<ResetId, CommitId> {
+  readonly context: (invocation: AuthInvocation, credential: Redacted.Redacted<string>) => Effect.Effect<PasswordPreparedContext, PasswordFailure>;
+  readonly resetContext: (invocation: AuthInvocation, input: {
+    readonly intentCredential: Redacted.Redacted<string>;
+    readonly continuationCredential: Redacted.Redacted<string>;
+  }) => Effect.Effect<PasswordPreparedContext, PasswordFailure, ResetId>;
+  readonly planCompleteAuthorized: (invocation: AuthInvocation, input: {
+    readonly intentCredential: Redacted.Redacted<string>;
+  }, authorization: PasswordPreparedAuthorization) => Effect.Effect<PasswordPreparedCompletionPlan<CommitId>, PasswordFailure>;
+  readonly planResetCompleteAuthorized: (invocation: AuthInvocation, input: {
+    readonly intentCredential: Redacted.Redacted<string>;
+    readonly continuationCredential: Redacted.Redacted<string>;
+  }, authorization: PasswordPreparedAuthorization) => Effect.Effect<PasswordPreparedCompletionPlan<CommitId>, PasswordFailure, ResetId>;
+}
+/** Separate assertion payloads; no change to ordinary password actionProof. Each
+ * target capability is authenticated before factor claim; final target plans keep
+ * their original proof/CAS/policy owner. Factor consumption is never refunded. */
+declare const makePasskeyPasswordActions: <const Id extends string, const PasskeyId extends string, PreparedId, ResetId, CommitId>(moduleId: Id, options: {
+  readonly passkeys: ReturnType<typeof makePasskeyActions<PasskeyId>>;
+  readonly prepared: {
+    readonly PasswordPrepared: Context.Key<PreparedId, Prepared<ResetId, CommitId>>;
+  };
+}) => Readonly<{
+  PasswordActions: Context.Service<{
+    readonly moduleId: Id;
+    readonly kind: "passkey-password-actions";
+  }, {
+    readonly begin: (invocation: AuthInvocation, input: {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly profileId: string;
+      readonly intentCredential: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<typeof PasskeyAuthenticationStarted.Type>, Failure>;
+    readonly complete: (invocation: AuthInvocation, input: {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Redacted.Redacted<string>;
+      readonly response: Redacted.Redacted<string>;
+      readonly intentCredential: Redacted.Redacted<string>;
+    }) => Effect.Effect<AuthOperationResult<{
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }>, Failure, CommitId>;
+  }>;
+  layer: Layer.Layer<{
+    readonly moduleId: Id;
+    readonly kind: "passkey-password-actions";
+  }, never, {
+    readonly moduleId: PasskeyId;
+    readonly kind: "passkey-actions";
+  } | Exclude<PreparedId, import("effect/Scope").Scope>>;
+  operations: Readonly<{
+    Begin: AuthOperation<`${Id}/passkey/password/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.Int;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        readonly allowCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rpId: Schema.String;
+          readonly timeout: Schema.Int;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          readonly allowCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    Complete: AuthOperation<`${Id}/passkey/password/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+  }>;
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/password/begin`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.String;
+    readonly profileId: Schema.String;
+    readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly expiresAtMillis: Schema.Int;
+    readonly options: Schema.Struct<{
+      readonly challenge: Schema.String;
+      readonly rpId: Schema.String;
+      readonly timeout: Schema.Int;
+      readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+      readonly allowCredentials: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.Literal<"public-key">;
+        readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+      }>>;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/password/complete`, Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+    readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  handlersLayer: Layer.Layer<OperationHandler<`${Id}/passkey/password/begin`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly commandId: string;
+    readonly profileId: string;
+    readonly intentCredential: Redacted.Redacted<string>;
+  }, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly expiresAtMillis: number;
+    readonly options: {
+      readonly challenge: string;
+      readonly rpId: string;
+      readonly timeout: number;
+      readonly userVerification: "preferred" | "required";
+      readonly allowCredentials: readonly {
+        readonly type: "public-key";
+        readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+      }[];
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/passkey/password/complete`, {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+    readonly bindingCredential: Redacted.Redacted<string>;
+    readonly response: Redacted.Redacted<string>;
+    readonly intentCredential: Redacted.Redacted<string>;
+  }, {
+    readonly invalidation: {
+      readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly maximumExposureMillis: number;
+      readonly oldAuthenticationEvidence: "rejected";
+    };
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, {
+    readonly moduleId: Id;
+    readonly kind: "passkey-password-actions";
+  } | Exclude<CommitId, import("effect/Scope").Scope>>;
+  reset: Readonly<{
+    PasswordActions: Context.Service<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-reset-password-actions";
+    }, {
+      readonly begin: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly commandId: string;
+        readonly profileId: string;
+        readonly intentCredential: Redacted.Redacted<string>;
+        readonly continuationCredential: Redacted.Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<typeof PasskeyAuthenticationStarted.Type>, Failure>;
+      readonly complete: (invocation: AuthInvocation, input: {
+        readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Redacted.Redacted<string>;
+        readonly response: Redacted.Redacted<string>;
+        readonly intentCredential: Redacted.Redacted<string>;
+        readonly continuationCredential: Redacted.Redacted<string>;
+      }) => Effect.Effect<AuthOperationResult<{
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      }>, Failure, CommitId>;
+    }>;
+    layer: Layer.Layer<{
+      readonly moduleId: Id;
+      readonly kind: "passkey-reset-password-actions";
+    }, never, {
+      readonly moduleId: PasskeyId;
+      readonly kind: "passkey-actions";
+    } | Exclude<PreparedId, import("effect/Scope").Scope> | Exclude<ResetId, import("effect/Scope").Scope>>;
+    operations: Readonly<{
+      Begin: AuthOperation<`${Id}/passkey/password/reset/begin`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.String;
+        readonly profileId: Schema.String;
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly continuationCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly expiresAtMillis: Schema.Int;
+        readonly options: Schema.Struct<{
+          readonly challenge: Schema.String;
+          readonly rpId: Schema.String;
+          readonly timeout: Schema.Int;
+          readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+          readonly allowCredentials: Schema.$Array<Schema.Struct<{
+            readonly type: Schema.Literal<"public-key">;
+            readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+          }>>;
+        }>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly commandId: Schema.String;
+          readonly profileId: Schema.String;
+          readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly continuationCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly expiresAtMillis: Schema.Int;
+          readonly options: Schema.Struct<{
+            readonly challenge: Schema.String;
+            readonly rpId: Schema.String;
+            readonly timeout: Schema.Int;
+            readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+            readonly allowCredentials: Schema.$Array<Schema.Struct<{
+              readonly type: Schema.Literal<"public-key">;
+              readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+            }>>;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>;
+        readonly exposure: "public";
+        readonly access: "any";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+      Complete: AuthOperation<`${Id}/passkey/password/reset/complete`, Schema.Struct<{
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+        readonly continuationCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      }>, Schema.Struct<{
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>, Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, never, {
+        readonly payload: Schema.Struct<{
+          readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+          readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+          readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+          readonly continuationCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        }>;
+        readonly success: Schema.Struct<{
+          readonly invalidation: Schema.Struct<{
+            readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+            readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+            readonly maximumExposureMillis: Schema.Natural;
+            readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+          }>;
+        }>;
+        readonly error: Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>;
+        readonly exposure: "public";
+        readonly access: "any";
+        readonly replay: "single-use";
+        readonly credentials: true;
+      }>;
+    }>;
+    group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/password/reset/begin`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.String;
+      readonly profileId: Schema.String;
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly continuationCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: Schema.Int;
+      readonly options: Schema.Struct<{
+        readonly challenge: Schema.String;
+        readonly rpId: Schema.String;
+        readonly timeout: Schema.Int;
+        readonly userVerification: Schema.Literals<readonly ["required", "preferred"]>;
+        readonly allowCredentials: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.Literal<"public-key">;
+          readonly id: Schema.brand<Schema.String, "effect-auth/PasskeyProtocolCredentialId">;
+        }>>;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/passkey/password/reset/complete`, Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly response: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly intentCredential: Schema.RedactedFromValue<Schema.String>;
+      readonly continuationCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [Schema.Union<readonly [Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+    handlersLayer: Layer.Layer<OperationHandler<`${Id}/passkey/password/reset/begin`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly commandId: string;
+      readonly profileId: string;
+      readonly intentCredential: Redacted.Redacted<string>;
+      readonly continuationCredential: Redacted.Redacted<string>;
+    }, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly expiresAtMillis: number;
+      readonly options: {
+        readonly challenge: string;
+        readonly rpId: string;
+        readonly timeout: number;
+        readonly userVerification: "preferred" | "required";
+        readonly allowCredentials: readonly {
+          readonly type: "public-key";
+          readonly id: string & import("effect/Brand").Brand<"effect-auth/PasskeyProtocolCredentialId">;
+        }[];
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable> | OperationHandler<`${Id}/passkey/password/reset/complete`, {
+      readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
+      readonly bindingCredential: Redacted.Redacted<string>;
+      readonly response: Redacted.Redacted<string>;
+      readonly intentCredential: Redacted.Redacted<string>;
+      readonly continuationCredential: Redacted.Redacted<string>;
+    }, {
+      readonly invalidation: {
+        readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+        readonly existingSessions: "immediate" | "original-absolute-expiry";
+        readonly maximumExposureMillis: number;
+        readonly oldAuthenticationEvidence: "rejected";
+      };
+    }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | NewPasswordRejected | OperationForbidden | OperationPrivateOutputUnsupported | PasskeyActionRequired | PasskeyMethodUnsupported | PasskeyRejected | PasskeyUnavailable | PasswordActionRequired | PasswordCheckUnavailable | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, never, {
+      readonly moduleId: Id;
+      readonly kind: "passkey-reset-password-actions";
+    } | Exclude<CommitId, import("effect/Scope").Scope>>;
+  }>;
+}>;
+//#endregion
+export { makePasskeyPasswordActions };
+//# sourceMappingURL=PasskeyPassword.d.mts.map